Bhupinder Singh Gahunia explains how business process owners can create, plan, execute, and document control performance plans using the Manual Control Performance functionality in SAP Process Control 10.1.

Big Data technologies offer a huge opportunity to organizations to consolidate data from a variety of data sources and derive meaningful insights from it that can help in achieving business growth. With this opportunity, there are also challenges with respect to information security. Database technologies offer a variety of ways to implement information security. SAP HANA uses analytic authorizations to implement row-level security ensuring the information is consumed only by its rightful users. However, SAP HANA does not offer a column-level security feature out of the box. Abhijit Ingale describes the process to implement column-level security in SAP HANA.

Ticketing functionality enables role designers to track all role changes using ticket numbers. After you enable ticketing functionality, when a role designer changes a role, a pop-up prompts the designer to enter a ticket number. This ticket number is used in all phases of role methodology, role copy, and mass maintenance. A new tab, Ticket Number, has been added to the Additional Details tab of the role. Vinay Gupta describes this new feature that was introduced in SAP Access Control 10.1.

SAP Process Control provides a popular alternative to online completion of assessment surveys, tests of effectiveness, and other surveys—SAP Interactive Forms by Adobe. These offline forms are easy to use but can be initially challenging to set up and test. Jan Gardiner and Matt Hartnett present an end-to-end guide that will help you configure, deploy, and manage the offline forms.

Hernan Huwyler goes over the particular requirements for reviewing the user and database access in your SAP system to prepare for the new General Data Protection Regulation (GDPR) in the European Union. Controls should be reinforced on user and database rights to access tables with personal information. Documentation, validation, and coordination should also be more comprehensive.

Role administrators and designers need the ability to update a business role to add or remove a technical role association of a business role while still leaving the approved or active version of the business role to use in Access Request Management and Access Risk Analysis. Business role versioning provides the flexibility to provision an approved version of a business role in Access Request Management. In business role versioning, only the addition and the removal of roles are available for versioning.

Kehinde Eseyin shows how to activate tracing to resolve authorization errors in SAP HANA. You then can troubleshoot authorization errors related to repository role activation, SQL privileges, and analytical privileges.

Segregation of duties (SoD) risks will not be detected by an out-of-the box SAP system rule set if your organization implements Master Data Governance (MDG).
Nibha Kumari and Gary PrewettIf show how to get a complete picture of SoD risks by modifying the rule set to detect cross-system risks associated with material, customer, and vendor master data maintenance in the MDG system.

Joshu Madina explains the process of identifying invalid mitigation assignments for user-level mitigations and role-level mitigations. He also provides you with details regarding extending the validity for expired mitigations and deleting invalid mitigation assignments.

Juan Pablo Perez-Etchegoyen explains the details of the United States Computer Emergency Readiness Team (US-CERT) alert TA16-132A issued by the US Department of Homeland Security (DHS) and the vulnerability that triggered it. He also describes the mitigation steps that organizations using SAP systems need to follow to close the security gap potentially opened by this vulnerability.

Kehinde Eseyin shows how SAP Audit Management can help improve the different facets of the internal audit life cycle including audit planning and preparation while enforcing process control and risk management.

Many companies use solutions like SAP Access Control to analyze user access before roles are assigned and then report suspect activity to business owners. In this video, you'll see how leading companies are moving from reporting on these “potential” segregation of duties (SoD) violations to calculating their actual financial exposure by leveraging SAP Access Violation Management.